From c6cb8d0f6f351b03010a74b63a7aaaaca977603e Mon Sep 17 00:00:00 2001
From: "Admiral H. Curtiss" <pikachu025@gmail.com>
Date: Tue, 27 May 2014 15:01:59 +0200
Subject: [PATCH] NAS: Prevent download path attack.

---
 nas_server.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/nas_server.py b/nas_server.py
index cef3d7c..4b1022c 100644
--- a/nas_server.py
+++ b/nas_server.py
@@ -149,8 +149,14 @@ class NasHTTPServerHandler(BaseHTTPServer.BaseHTTPRequestHandler):
             action = post["action"]
 
             ret = ""
-            dlcpath = "dlc/" + post["gamecd"]
+            dlcdir = os.path.abspath('dlc')
+            dlcpath = os.path.abspath("dlc/" + post["gamecd"])
             dlc_contenttype = False
+            
+            if os.path.commonprefix([dlcdir, dlcpath]) != dlcdir:
+                logging.log(logging.WARNING, 'Attempted directory traversal attack "%s", cancelling.', dlcpath)
+                self.send_response(403)
+                return
 
             def safeloadfi(fn, mode='rb'):
                 '''